# Portfolio Governance

## Purpose

This repository is the coordination and publication surface for the public trust-infrastructure portfolio. It records repository lifecycle, architectural relationships, adoption expectations, and portfolio-level evidence. It does not supersede the governance or release authority of any member repository.

## Authority model

| Decision | Authority |
|---|---|
| Profile narrative and portfolio taxonomy | This repository |
| Repository tier and lifecycle classification | Portfolio maintainer, recorded in `data/repository-status.yaml` |
| Canonical semantics | The repository identified as semantic authority in `data/portfolio-relationships.yaml` |
| Portable schema contracts | The repository identified as schema authority |
| Project releases and versioning | Each member repository |
| Cross-repository compatibility claims | Evidence recorded in this repository and participating repositories |

## Delegation and scope

A portfolio classification delegates no technical authority to this repository. A repository remains authoritative only for the scope explicitly recorded in the relationship registry. Incubating repositories may propose artifacts but must not silently redefine canonical semantics or portable contracts.

## Change control

Changes to lifecycle, tier, authority, or cross-repository dependency records require:

1. a pull request describing the operational impact;
2. successful portfolio validation;
3. an updated review date;
4. a release-impact record when compatibility or authority changes.

## Revocation and supersession

A repository may be demoted, archived, or superseded when maintenance ends, authority moves, or adoption gates are no longer met. The status registry must preserve the prior state through version control and identify the superseding repository where applicable.

## Evidence and auditability

Machine-readable records in `data/` are the source of truth. Human-readable portfolio documentation is derived from or checked against those records. Validation results generated by CI are the minimum portfolio-level assurance evidence.